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IN THE CLAIMS 

What is claimed is: 

1 . (Original) A method for gathering and monitoring the simultaneous status of 
nodes in a storage area network (SAN), comprising: 

receiving alert messages corresponding to status events in the storage area 
network, each status event having a corresponding event category and severity value; 

aggregating the alert messages according to event category and severity value 
to generate a category specific severity ranking of the alert messages; 

displaying a status array having a plurality of chart entries, each chart entry 
corresponding to alert messages of a particular event category and each chart entry 
having a node entry for each node having status attributable to the alert messages; and 

displaying, within at least one chart entry, node entries having a status event 
associated with the event category for that chart entry, the node entries displayed in the 
chart entry according to the severity ranking and each node entry indicative of a severity 
scale of status for the corresponding effected node. 

2. (Currently Amended) The method of claim 1 wherein displaying, within the at 
least one chart entry, comprises: 

accumulating events of each of a plurality of severity levels, each severity level 
representing a rang e of seventy values such that a given status event with a given 
severity value has a correspo nding ^ severity value of the 

given status event is within a range of severity values for the corresponding severity 
level, wherein the severity scale for a node entry is an enumeration of events received 
for each of the plurality of severity levels within the severity ranking, the severity ranking 
determined by the severity scale for each node entry ; and 

displaying the enumeration of events received for each node entry within the at 
least one chart entry containing that node entry , the enumeration of events received 
beinfld, j splayed jn a n orjjexac^Minfl.to.,the severity ranking. 
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3. (Original) The method of claim 2 wherein the enumeration is a histogram having 
a magnitude based on the severity scale and a quantity of events within each severity 
level within the severity ranking. 

4. (Original) The method of claim 3 wherein the histogram has a plurality of visually 
overlapping elongated bar segments, each elongated bar segment corresponding to a 
particular severity level. 

5. (Original) The method of claim 1 further including discovering a topology of 
nodes in the SAN, wherein the alert messages correspond to status events for each of a 
plurality of selected nodes in a selection tree, the selection tree indicative of the nodes 
in the SAN. 

6. (Original) The method of claim 1 further including filtering the status events to 
compute a subset of elected events, wherein the received events correspond to elected 
events determined in response to predetermined filtering logic at the agents processing 
the elected events. 

7. (Original) The method of claim 1 wherein each chart entry has a magnitude axis, 
the magnitude axis indicative of a relative range of the quantity of status events within 
each of the severity levels corresponding to a plurality of node entries reflected in the 
chart entry. 

8. (Currently Amended) The method of claim 1 wherein each chart entry has a 
manageable entity axis, the manageable entity axis arranged, for each node, according 
to increasing seeuf-itv -severity scale denoting the severity ranking for each node 
included in the chart entry, and further comprising computing the severity scale for each 
node according to a predetermined severity metric. 
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9. (Original) The method of claim 1 wherein the severity level corresponds to a 
threshold value, the threshold value identifying triggering of an event having the 
corresponding severity level. 

10. (Original) The method of claim 1 wherein each event in an event category has a 
set of threshold values, the threshold values indicative of a quantitative metric triggering 
the particular event and severity. 

1 1 . (Original) The method of claim 10 further comprising processing and 
propagating the threshold values to remote agents, the remote agents operable to 
analyze nodes and determine when a particular metric satisfying a triggering threshold 
is attained and generate the corresponding event. 

12. (Original) The method of claim 1 wherein the nodes further comprise 
manageable entities, the manageable entities responsive to the server in a SAN and 
further including storage entities, connectivity entities, and database entities. 

1 3. (Original) The method of claim 1 further comprising selectively suppressing 
events of a particular category and severity. 

14. (Original) The method of claim 1 wherein the chart entries in the status array are 
further subdivided into chart entries directed to manageable entity health, manageable 
entity performance, and storage system capacity. 

15. (Original) The method of claim 1 comprising: 

receiving a selection of at least one node in a hierarchical arrangement of 

nodes; and 

wherein receiving, aggregating, displaying a status array, and displaying, within 
at least one chart entry, node entries are performed in relation to the selected at least 
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one node in order to display the simultaneous status of nodes in a storage area 
network. 

16. (Original) The method of claim 1 wherein: 

the status array is an N by M matrix of the plurality of chart entries, the 
plurality of chart entries including: 

i) a general alert chart entry displaying alert status of managed entities in 
the storage area network; 

ii) a storage chart entry indicating alert status of managed storage entities 
in the storage area network; 

iii) a host chart entry indicating alert status of managed host entities in the 
storage area network; and 

iv) a connectivity chart entry indicating alert status of managed 
connectivity entities in the storage area network. 

17. (Original) The method of claim 1 further comprising 

receiving a user input corresponding to selection of at least one node entry from 

among the node entries displayed in the status array; 

displaying an expanded menu of status options for the selected entry; and 
receiving a response to the menus of status options and displaying an expanded 

status report corresponding to the expanded menu. 

18. (Original) A network monitoring device for gathering and monitoring the 
simultaneous status of nodes in a storage area network (SAN), comprising: 

a server having a correlator operable to receive alert messages 
corresponding to status events in the storage area network, each status event having a 
corresponding event category and severity value; 

an aggregator operable to aggregate the alert messages according to 
event category and severity value to generate a category specific severity ranking of the 
alert messages; and 
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an operator console operable to display a status array having a plurality of chart 
entries, each chart entry corresponding to alert messages of a particular event category 
and each chart entry having a node entry for each node having status attributable to the 
alert messages, the console further operable to display, within at least one chart entry, 
node entries having a status event associated with the event category for that chart 
entry, the node entries displayed in the chart entry according to the severity ranking and 
each node entry indicative of a severity scale of status for the corresponding effected 
node. 

19. (Currently Amended) The network monitoring device of claim 18 wherein the 
accumulator is further operable to: 

accumulate events of each of a plurality of severity levels , each severity level 
representing a ran ge of severity values such that a given status event w ith a given 
severity value has a corresponding severity level when the given severity value of the 
given status event is within a range of severity values for the corresponding severity 
level , wherein the severity scale for a node entry is an enumeration of events received 
for each of the plurality of severity levels within the severity ranking , the severity ranking 
determined by the severity scale for each node entry; and 

display, within the at least one chart entry, the enumeration of events received for 
each node entry within the at least one chart entry containing that node entry , the 
enumeration of events received. .b the severity 

ranking . 

20. (Original) The network monitoring device of claim 19 wherein the enumeration is 
a histogram having a magnitude based on the severity scale and a quantity of events 
within each severity level within the severity ranking. 

21 . (Original) The network monitoring device of claim 20 wherein the histogram has 
a plurality of visually overlapping elongated bar segments, each elongated bar segment 
corresponding to a particular severity level. 
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22. (Original) The network monitoring device of claim 18 wherein the server is 
further operable to discover a topology of nodes in the SAN, wherein the alert 
messages correspond to status events for each of a plurality of selected nodes in a 
selection tree, the selection tree indicative of the nodes in the SAN. 

23. (Original) The network monitoring device of claim 1 8 wherein the server is 
further operable to filter the status events to compute a subset of elected events, 
wherein the received events correspond to elected events determined in response to 
predetermined filtering logic at the agents processing the elected events. 

24. (Original) The network monitoring device of claim 1 8 wherein each chart entry 
has a magnitude axis, the magnitude axis indicative of a relative range of the quantity of 
status events within each of the severity levels corresponding to a plurality of node 
entries reflected in the chart entry. 

25. (Currently Amended) The network monitoring device of claim 1 8 wherein each 
chart entry has a manageable entity axis, the manageable entity axis arranged, for each 
node, according to increasing secur i ty severity scale denoting the severity ranking for 
each node included in the chart entry, and further comprising computing the severity 
scale for each node according to a predetermined severity metric. 

26. (Original) The network monitoring device of claim 18 wherein the severity level 
corresponds to a threshold value, the threshold value identifying triggering of an event 
having the corresponding severity level. 

27. (Original) The network monitoring device of claim 18 wherein each event in an 
event category has a set of threshold values, the threshold values indicative of a 
quantitative metric triggering the particular event and severity. 
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28. (Original) The network monitoring device of claim 27 wherein the server is 
further operable to processing and propagating the threshold values to remote agents, 
the remote agents operable to analyze nodes and determine when a particular metric 
satisfying a triggering threshold is attained and generate the corresponding event. 

29. (Original) The network monitoring device of claim 1 8 wherein the nodes further 
comprise manageable entities, the manageable entities responsive to the server in a 
SAN and further including storage entities, connectivity entities, and database entities. 

30. (Original) The network monitoring device of claim 18 wherein the server is 
operable to selectively suppress events of a particular category and severity. 

31 . (Original) The network monitoring device of claim 1 8 wherein the chart entries in 
the status array are further subdivided into chart entries directed to manageable entity 
health, manageable entity performance, and storage system capacity. 

32. (Original) The network monitoring device of claim 1 8 wherein the server is 
further operable to receive a selection of at least one node in a hierarchical 
arrangement of nodes, and display, within at least one chart entry, node entries in 
relation to the selected at least one node in order to display the simultaneous status of 
nodes in a storage area network. 

33. (Original) The network monitoring device of claim 18 wherein: 

the status array is an N by M matrix of the plurality of chart entries, the 
plurality of chart entries including: 

i) a general alert chart entry displaying alert status of managed entities in 
the storage area network; 

ii) a storage chart entry indicating alert status of managed storage entities 
in the storage area network; 
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iii) a host chart entry indicating alert status of managed host entities in the 
storage area network; and 

iv) a connectivity chart entry indicating alert status of managed 
connectivity entities in the storage area network. 

34. (Original) The network monitoring device of claim 18 wherein the server is 
further operable to: 

receive a user input corresponding to selection of at least one node entry from 

among the node entries displayed in the status array; 

display an expanded menu of status options for the selected entry; and 
display an expanded status report corresponding to the expanded menu and a 

response to the menu of status options. 

35. (Original) A computer program product having a computer readable medium 
operable to store computer program logic embodied in computer program code 
encoded thereon for gathering and monitoring the simultaneous status of nodes in a 
storage area network (SAN), comprising: 

computer program code for receiving alert messages corresponding to 
status events in the storage area network, each status event having a corresponding 
event category and severity value; 

computer program code for aggregating the alert messages according to 
event category and severity value to generate a category specific severity ranking of the 
alert messages; 

computer program code for displaying a status array having a plurality of chart 
entries, each chart entry corresponding to alert messages of a particular event category 
and each chart entry having a node entry for each node having status attributable to the 
alert messages; and 

computer program code for displaying, within at least one chart entry, node 
entries having a status event associated with the event category for that chart entry, the 
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node entries displayed in the chart entry according to the severity ranking and each 
node entry indicative of a severity scale of status for the corresponding effected node. 

36. (Original) A computer data signal having program code for gathering and 
monitoring the simultaneous status of nodes in a storage area network (SAN), 
comprising: 

program code for receiving alert messages corresponding to status events 
in the storage area network, each status event having a corresponding event category 
and severity value; 

program code for aggregating the alert messages according to event 
category and severity value to generate a category specific severity ranking of the alert 
messages; 

program code for displaying a status array having a plurality of chart entries, 
each chart entry corresponding to alert messages of a particular event category and 
each chart entry having a node entry for each node having status attributable to the 
alert messages; and 

program code for displaying, within at least one chart entry, node entries having 
a status event associated with the event category for that chart entry, the node entries 
displayed in the chart entry according to the severity ranking and each node entry 
indicative of a severity scale of status for the corresponding effected node. 

37. (Original) A network monitoring device for gathering and monitoring the 
simultaneous status of nodes in a storage area network (SAN), comprising: 

means for receiving alert messages corresponding to status events in the 
storage area network, each status event having a corresponding event category and 
severity value; 

means for aggregating the alert messages according to event category and 
severity value to generate a category specific severity ranking of the alert messages; 

means for displaying a status array having a plurality of chart entries, each chart 
entry corresponding to alert messages of a particular event category and each chart 
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entry having a node entry for each node having status attributable to the alert 
messages; and 

means for displaying, within at least one chart entry, node entries having a status 
event associated with the event category for that chart entry, the node entries displayed 
in the chart entry according to the severity ranking and each node entry indicative of a 
severity scale of status for the corresponding effected node. 

38. (New) The method of claim 1 , wherein the severity scale for each node entry is 
an aggregate value representative of a number of alert messages received at each 
node entry for a given sampling interval, wherein each node entry is weighted with 
respect to a corresponding severity level for each alert message, each severity level 
representing a range of severity values such that a given status event with a given 
severity value has a corresponding severity level when the given severity value of the 
given status event is within a range of severity values for the corresponding severity 
level. 

39. (New) The network monitoring device of claim 1 8, wherein the severity scale for 
each node entry is an aggregate value representative of a number of alert messages 
received at each node entry for a given sampling interval , wherein each node entry is 
weighted with respect to a corresponding severity level for each alert message, each 
severity level representing a range of severity values such that a given status event with 
a given severity value has a corresponding severity level when the given severity value 
of the given status event is within a range of severity values for the corresponding 
severity level. 

40. (New) The computer program product of claim 35, wherein the severity scale for 
each node entry is an aggregate value representative of a number of alert messages 
received at each node entry for a given sampling interval, wherein each node entry is 
weighted with respect to a corresponding severity level for each alert message, each 
severity level representing a range of severity values such that a given status event with 
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a given severity value has a corresponding severity level when the given severity value 
of the given status event is within a range of severity values for the corresponding 
severity level. 

41 . (New) The computer data signal of claim 36, wherein the severity scale for each 
node entry is an aggregate value representative of a number of alert messages 
received at each node entry for a given sampling interval, wherein each node entry is 
weighted with respect to a corresponding severity level for each alert message, each 
severity level representing a range of severity values such that a given status event with 
a given severity value has a corresponding severity level when the given severity value 
of the given status event is within a range of severity values for the corresponding 
severity level. 

42. (New) The network monitoring device of claim 37, wherein the severity scale for 
each node entry is an aggregate value representative of a number of alert messages 
received at each node entry for a given sampling interval, wherein each node entry is 
weighted with respect to a corresponding severity level for each alert message, each 
severity level representing a range of severity values such that a given status event with 
a given severity value has a corresponding severity level when the given severity value 
of the given status event is within a range of severity values for the corresponding 
severity level. 



